Deleted Added
sdiff udiff text old ( 113911 ) new ( 124211 )
full compact
auth.c (113911) auth.c (124211)
1/*
2 * Copyright (c) 2000 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.

--- 9 unchanged lines hidden (view full) ---

18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
1/*
2 * Copyright (c) 2000 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.

--- 9 unchanged lines hidden (view full) ---

18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
26RCSID("$OpenBSD: auth.c,v 1.46 2002/11/04 10:07:53 markus Exp $");
27RCSID("$FreeBSD: head/crypto/openssh/auth.c 113911 2003-04-23 17:13:13Z des $");
26RCSID("$OpenBSD: auth.c,v 1.49 2003/08/26 09:58:43 markus Exp $");
27RCSID("$FreeBSD: head/crypto/openssh/auth.c 124211 2004-01-07 11:16:27Z des $");
28
29#ifdef HAVE_LOGIN_H
30#include <login.h>
31#endif
32#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
33#include <shadow.h>
34#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
35

--- 14 unchanged lines hidden (view full) ---

50#include "uidswap.h"
51#include "tildexpand.h"
52#include "misc.h"
53#include "bufaux.h"
54#include "packet.h"
55
56/* import */
57extern ServerOptions options;
28
29#ifdef HAVE_LOGIN_H
30#include <login.h>
31#endif
32#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
33#include <shadow.h>
34#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
35

--- 14 unchanged lines hidden (view full) ---

50#include "uidswap.h"
51#include "tildexpand.h"
52#include "misc.h"
53#include "bufaux.h"
54#include "packet.h"
55
56/* import */
57extern ServerOptions options;
58extern Buffer loginmsg;
58
59/* Debugging messages */
60Buffer auth_debug;
61int auth_debug_init;
62
63/*
64 * Check if the user is allowed to log in via ssh. If user is listed
65 * in DenyUsers or one of user's groups is listed in DenyGroups, false
66 * will be returned. If AllowUsers isn't empty and user isn't listed
67 * there, or if AllowGroups isn't empty and one of user's groups isn't
68 * listed there, false will be returned.
69 * If the user's shell is not executable, false will be returned.
70 * Otherwise true is returned.
71 */
72int
73allowed_user(struct passwd * pw)
74{
75 struct stat st;
59
60/* Debugging messages */
61Buffer auth_debug;
62int auth_debug_init;
63
64/*
65 * Check if the user is allowed to log in via ssh. If user is listed
66 * in DenyUsers or one of user's groups is listed in DenyGroups, false
67 * will be returned. If AllowUsers isn't empty and user isn't listed
68 * there, or if AllowGroups isn't empty and one of user's groups isn't
69 * listed there, false will be returned.
70 * If the user's shell is not executable, false will be returned.
71 * Otherwise true is returned.
72 */
73int
74allowed_user(struct passwd * pw)
75{
76 struct stat st;
76 const char *hostname = NULL, *ipaddr = NULL;
77 const char *hostname = NULL, *ipaddr = NULL, *passwd = NULL;
77 char *shell;
78 int i;
78 char *shell;
79 int i;
79#ifdef WITH_AIXAUTHENTICATE
80 char *loginmsg;
81#endif /* WITH_AIXAUTHENTICATE */
82#if !defined(USE_PAM) && defined(HAVE_SHADOW_H) && \
83 !defined(DISABLE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
84 struct spwd *spw;
85 time_t today;
80#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
81 struct spwd *spw = NULL;
86#endif
87
88 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
89 if (!pw || !pw->pw_name)
90 return 0;
91
82#endif
83
84 /* Shouldn't be called if pw is NULL, but better safe than sorry... */
85 if (!pw || !pw->pw_name)
86 return 0;
87
92#if !defined(USE_PAM) && defined(HAVE_SHADOW_H) && \
93 !defined(DISABLE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
88#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
89 if (!options.use_pam)
90 spw = getspnam(pw->pw_name);
91#ifdef HAS_SHADOW_EXPIRE
94#define DAY (24L * 60 * 60) /* 1 day in seconds */
92#define DAY (24L * 60 * 60) /* 1 day in seconds */
95 if ((spw = getspnam(pw->pw_name)) != NULL) {
93 if (!options.use_pam && spw != NULL) {
94 time_t today;
95
96 today = time(NULL) / DAY;
97 debug3("allowed_user: today %d sp_expire %d sp_lstchg %d"
98 " sp_max %d", (int)today, (int)spw->sp_expire,
99 (int)spw->sp_lstchg, (int)spw->sp_max);
100
101 /*
102 * We assume account and password expiration occurs the
103 * day after the day specified.
104 */
105 if (spw->sp_expire != -1 && today > spw->sp_expire) {
96 today = time(NULL) / DAY;
97 debug3("allowed_user: today %d sp_expire %d sp_lstchg %d"
98 " sp_max %d", (int)today, (int)spw->sp_expire,
99 (int)spw->sp_lstchg, (int)spw->sp_max);
100
101 /*
102 * We assume account and password expiration occurs the
103 * day after the day specified.
104 */
105 if (spw->sp_expire != -1 && today > spw->sp_expire) {
106 log("Account %.100s has expired", pw->pw_name);
106 logit("Account %.100s has expired", pw->pw_name);
107 return 0;
108 }
109
110 if (spw->sp_lstchg == 0) {
107 return 0;
108 }
109
110 if (spw->sp_lstchg == 0) {
111 log("User %.100s password has expired (root forced)",
111 logit("User %.100s password has expired (root forced)",
112 pw->pw_name);
113 return 0;
114 }
115
116 if (spw->sp_max != -1 &&
117 today > spw->sp_lstchg + spw->sp_max) {
112 pw->pw_name);
113 return 0;
114 }
115
116 if (spw->sp_max != -1 &&
117 today > spw->sp_lstchg + spw->sp_max) {
118 log("User %.100s password has expired (password aged)",
118 logit("User %.100s password has expired (password aged)",
119 pw->pw_name);
120 return 0;
121 }
122 }
119 pw->pw_name);
120 return 0;
121 }
122 }
123#endif /* HAS_SHADOW_EXPIRE */
124#endif /* defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW) */
125
126 /* grab passwd field for locked account check */
127#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
128 if (spw != NULL)
129 passwd = spw->sp_pwdp;
130#else
131 passwd = pw->pw_passwd;
123#endif
124
132#endif
133
134 /* check for locked account */
135 if (!options.use_pam && passwd && *passwd) {
136 int locked = 0;
137
138#ifdef LOCKED_PASSWD_STRING
139 if (strcmp(passwd, LOCKED_PASSWD_STRING) == 0)
140 locked = 1;
141#endif
142#ifdef LOCKED_PASSWD_PREFIX
143 if (strncmp(passwd, LOCKED_PASSWD_PREFIX,
144 strlen(LOCKED_PASSWD_PREFIX)) == 0)
145 locked = 1;
146#endif
147#ifdef LOCKED_PASSWD_SUBSTR
148 if (strstr(passwd, LOCKED_PASSWD_SUBSTR))
149 locked = 1;
150#endif
151 if (locked) {
152 logit("User %.100s not allowed because account is locked",
153 pw->pw_name);
154 return 0;
155 }
156 }
157
125 /*
126 * Get the shell from the password data. An empty shell field is
127 * legal, and means /bin/sh.
128 */
129 shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
130
131 /* deny if shell does not exists or is not executable */
132 if (stat(shell, &st) != 0) {
158 /*
159 * Get the shell from the password data. An empty shell field is
160 * legal, and means /bin/sh.
161 */
162 shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
163
164 /* deny if shell does not exists or is not executable */
165 if (stat(shell, &st) != 0) {
133 log("User %.100s not allowed because shell %.100s does not exist",
166 logit("User %.100s not allowed because shell %.100s does not exist",
134 pw->pw_name, shell);
135 return 0;
136 }
137 if (S_ISREG(st.st_mode) == 0 ||
138 (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) {
167 pw->pw_name, shell);
168 return 0;
169 }
170 if (S_ISREG(st.st_mode) == 0 ||
171 (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) {
139 log("User %.100s not allowed because shell %.100s is not executable",
172 logit("User %.100s not allowed because shell %.100s is not executable",
140 pw->pw_name, shell);
141 return 0;
142 }
143
144 if (options.num_deny_users > 0 || options.num_allow_users > 0) {
173 pw->pw_name, shell);
174 return 0;
175 }
176
177 if (options.num_deny_users > 0 || options.num_allow_users > 0) {
145 hostname = get_canonical_hostname(options.verify_reverse_mapping);
178 hostname = get_canonical_hostname(options.use_dns);
146 ipaddr = get_remote_ipaddr();
147 }
148
149 /* Return false if user is listed in DenyUsers */
150 if (options.num_deny_users > 0) {
151 for (i = 0; i < options.num_deny_users; i++)
152 if (match_user(pw->pw_name, hostname, ipaddr,
153 options.deny_users[i])) {
179 ipaddr = get_remote_ipaddr();
180 }
181
182 /* Return false if user is listed in DenyUsers */
183 if (options.num_deny_users > 0) {
184 for (i = 0; i < options.num_deny_users; i++)
185 if (match_user(pw->pw_name, hostname, ipaddr,
186 options.deny_users[i])) {
154 log("User %.100s not allowed because listed in DenyUsers",
187 logit("User %.100s not allowed because listed in DenyUsers",
155 pw->pw_name);
156 return 0;
157 }
158 }
159 /* Return false if AllowUsers isn't empty and user isn't listed there */
160 if (options.num_allow_users > 0) {
161 for (i = 0; i < options.num_allow_users; i++)
162 if (match_user(pw->pw_name, hostname, ipaddr,
163 options.allow_users[i]))
164 break;
165 /* i < options.num_allow_users iff we break for loop */
166 if (i >= options.num_allow_users) {
188 pw->pw_name);
189 return 0;
190 }
191 }
192 /* Return false if AllowUsers isn't empty and user isn't listed there */
193 if (options.num_allow_users > 0) {
194 for (i = 0; i < options.num_allow_users; i++)
195 if (match_user(pw->pw_name, hostname, ipaddr,
196 options.allow_users[i]))
197 break;
198 /* i < options.num_allow_users iff we break for loop */
199 if (i >= options.num_allow_users) {
167 log("User %.100s not allowed because not listed in AllowUsers",
200 logit("User %.100s not allowed because not listed in AllowUsers",
168 pw->pw_name);
169 return 0;
170 }
171 }
172 if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
173 /* Get the user's group access list (primary and supplementary) */
174 if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
201 pw->pw_name);
202 return 0;
203 }
204 }
205 if (options.num_deny_groups > 0 || options.num_allow_groups > 0) {
206 /* Get the user's group access list (primary and supplementary) */
207 if (ga_init(pw->pw_name, pw->pw_gid) == 0) {
175 log("User %.100s not allowed because not in any group",
208 logit("User %.100s not allowed because not in any group",
176 pw->pw_name);
177 return 0;
178 }
179
180 /* Return false if one of user's groups is listed in DenyGroups */
181 if (options.num_deny_groups > 0)
182 if (ga_match(options.deny_groups,
183 options.num_deny_groups)) {
184 ga_free();
209 pw->pw_name);
210 return 0;
211 }
212
213 /* Return false if one of user's groups is listed in DenyGroups */
214 if (options.num_deny_groups > 0)
215 if (ga_match(options.deny_groups,
216 options.num_deny_groups)) {
217 ga_free();
185 log("User %.100s not allowed because a group is listed in DenyGroups",
218 logit("User %.100s not allowed because a group is listed in DenyGroups",
186 pw->pw_name);
187 return 0;
188 }
189 /*
190 * Return false if AllowGroups isn't empty and one of user's groups
191 * isn't listed there
192 */
193 if (options.num_allow_groups > 0)
194 if (!ga_match(options.allow_groups,
195 options.num_allow_groups)) {
196 ga_free();
219 pw->pw_name);
220 return 0;
221 }
222 /*
223 * Return false if AllowGroups isn't empty and one of user's groups
224 * isn't listed there
225 */
226 if (options.num_allow_groups > 0)
227 if (!ga_match(options.allow_groups,
228 options.num_allow_groups)) {
229 ga_free();
197 log("User %.100s not allowed because none of user's groups are listed in AllowGroups",
230 logit("User %.100s not allowed because none of user's groups are listed in AllowGroups",
198 pw->pw_name);
199 return 0;
200 }
201 ga_free();
202 }
203
204#ifdef WITH_AIXAUTHENTICATE
205 /*
206 * Don't check loginrestrictions() for root account (use
207 * PermitRootLogin to control logins via ssh), or if running as
208 * non-root user (since loginrestrictions will always fail).
209 */
231 pw->pw_name);
232 return 0;
233 }
234 ga_free();
235 }
236
237#ifdef WITH_AIXAUTHENTICATE
238 /*
239 * Don't check loginrestrictions() for root account (use
240 * PermitRootLogin to control logins via ssh), or if running as
241 * non-root user (since loginrestrictions will always fail).
242 */
210 if ((pw->pw_uid != 0) && (geteuid() == 0) &&
211 loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) {
212 int loginrestrict_errno = errno;
243 if ((pw->pw_uid != 0) && (geteuid() == 0)) {
244 char *msg;
213
245
214 if (loginmsg && *loginmsg) {
215 /* Remove embedded newlines (if any) */
216 char *p;
217 for (p = loginmsg; *p; p++) {
218 if (*p == '\n')
219 *p = ' ';
246 if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &msg) != 0) {
247 int loginrestrict_errno = errno;
248
249 if (msg && *msg) {
250 buffer_append(&loginmsg, msg, strlen(msg));
251 aix_remove_embedded_newlines(msg);
252 logit("Login restricted for %s: %.100s",
253 pw->pw_name, msg);
220 }
254 }
221 /* Remove trailing newline */
222 *--p = '\0';
223 log("Login restricted for %s: %.100s", pw->pw_name,
224 loginmsg);
255 /* Don't fail if /etc/nologin set */
256 if (!(loginrestrict_errno == EPERM &&
257 stat(_PATH_NOLOGIN, &st) == 0))
258 return 0;
225 }
259 }
226 /* Don't fail if /etc/nologin set */
227 if (!(loginrestrict_errno == EPERM &&
228 stat(_PATH_NOLOGIN, &st) == 0))
229 return 0;
230 }
231#endif /* WITH_AIXAUTHENTICATE */
232
233 /* We found no reason not to let this user try to log on... */
234 return 1;
235}
236
237Authctxt *

--- 10 unchanged lines hidden (view full) ---

248 void (*authlog) (const char *fmt,...) = verbose;
249 char *authmsg;
250
251 /* Raise logging level */
252 if (authenticated == 1 ||
253 !authctxt->valid ||
254 authctxt->failures >= AUTH_FAIL_LOG ||
255 strcmp(method, "password") == 0)
260 }
261#endif /* WITH_AIXAUTHENTICATE */
262
263 /* We found no reason not to let this user try to log on... */
264 return 1;
265}
266
267Authctxt *

--- 10 unchanged lines hidden (view full) ---

278 void (*authlog) (const char *fmt,...) = verbose;
279 char *authmsg;
280
281 /* Raise logging level */
282 if (authenticated == 1 ||
283 !authctxt->valid ||
284 authctxt->failures >= AUTH_FAIL_LOG ||
285 strcmp(method, "password") == 0)
256 authlog = log;
286 authlog = logit;
257
258 if (authctxt->postponed)
259 authmsg = "Postponed";
260 else
261 authmsg = authenticated ? "Accepted" : "Failed";
262
263 authlog("%s %s for %s%.100s from %.200s port %d%s",
264 authmsg,
265 method,
266 authctxt->valid ? "" : "illegal user ",
267 authctxt->user,
268 get_remote_ipaddr(),
269 get_remote_port(),
270 info);
271
287
288 if (authctxt->postponed)
289 authmsg = "Postponed";
290 else
291 authmsg = authenticated ? "Accepted" : "Failed";
292
293 authlog("%s %s for %s%.100s from %.200s port %d%s",
294 authmsg,
295 method,
296 authctxt->valid ? "" : "illegal user ",
297 authctxt->user,
298 get_remote_ipaddr(),
299 get_remote_port(),
300 info);
301
272#ifdef WITH_AIXAUTHENTICATE
302#ifdef CUSTOM_FAILED_LOGIN
273 if (authenticated == 0 && strcmp(method, "password") == 0)
303 if (authenticated == 0 && strcmp(method, "password") == 0)
274 loginfailed(authctxt->user,
275 get_canonical_hostname(options.verify_reverse_mapping),
276 "ssh");
277#endif /* WITH_AIXAUTHENTICATE */
278
304 record_failed_login(authctxt->user, "ssh");
305#endif
279}
280
281/*
282 * Check whether root logins are disallowed.
283 */
284int
285auth_root_allowed(char *method)
286{
287 switch (options.permit_root_login) {
288 case PERMIT_YES:
289 return 1;
290 break;
291 case PERMIT_NO_PASSWD:
292 if (strcmp(method, "password") != 0)
293 return 1;
294 break;
295 case PERMIT_FORCED_ONLY:
296 if (forced_command) {
306}
307
308/*
309 * Check whether root logins are disallowed.
310 */
311int
312auth_root_allowed(char *method)
313{
314 switch (options.permit_root_login) {
315 case PERMIT_YES:
316 return 1;
317 break;
318 case PERMIT_NO_PASSWD:
319 if (strcmp(method, "password") != 0)
320 return 1;
321 break;
322 case PERMIT_FORCED_ONLY:
323 if (forced_command) {
297 log("Root login accepted for forced command.");
324 logit("Root login accepted for forced command.");
298 return 1;
299 }
300 break;
301 }
325 return 1;
326 }
327 break;
328 }
302 log("ROOT LOGIN REFUSED FROM %.200s", get_remote_ipaddr());
329 logit("ROOT LOGIN REFUSED FROM %.200s", get_remote_ipaddr());
303 return 0;
304}
305
306
307/*
308 * Given a template and a passwd structure, build a filename
309 * by substituting % tokenised options. Currently, %% becomes '%',
310 * %h becomes the home directory and %u the username.

--- 75 unchanged lines hidden (view full) ---

386 host_status = check_host_in_hostfile(sysfile, host, key, found, NULL);
387
388 if (host_status != HOST_OK && userfile != NULL) {
389 user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
390 if (options.strict_modes &&
391 (stat(user_hostfile, &st) == 0) &&
392 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
393 (st.st_mode & 022) != 0)) {
330 return 0;
331}
332
333
334/*
335 * Given a template and a passwd structure, build a filename
336 * by substituting % tokenised options. Currently, %% becomes '%',
337 * %h becomes the home directory and %u the username.

--- 75 unchanged lines hidden (view full) ---

413 host_status = check_host_in_hostfile(sysfile, host, key, found, NULL);
414
415 if (host_status != HOST_OK && userfile != NULL) {
416 user_hostfile = tilde_expand_filename(userfile, pw->pw_uid);
417 if (options.strict_modes &&
418 (stat(user_hostfile, &st) == 0) &&
419 ((st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
420 (st.st_mode & 022) != 0)) {
394 log("Authentication refused for %.100s: "
421 logit("Authentication refused for %.100s: "
395 "bad owner or modes for %.200s",
396 pw->pw_name, user_hostfile);
397 } else {
398 temporarily_use_uid(pw);
399 host_status = check_host_in_hostfile(user_hostfile,
400 host, key, found, NULL);
401 restore_uid();
402 }

--- 87 unchanged lines hidden (view full) ---

490#ifdef BSD_AUTH
491 auth_session_t *as;
492#endif
493#endif
494 struct passwd *pw;
495
496 pw = getpwnam(user);
497 if (pw == NULL) {
422 "bad owner or modes for %.200s",
423 pw->pw_name, user_hostfile);
424 } else {
425 temporarily_use_uid(pw);
426 host_status = check_host_in_hostfile(user_hostfile,
427 host, key, found, NULL);
428 restore_uid();
429 }

--- 87 unchanged lines hidden (view full) ---

517#ifdef BSD_AUTH
518 auth_session_t *as;
519#endif
520#endif
521 struct passwd *pw;
522
523 pw = getpwnam(user);
524 if (pw == NULL) {
498 log("Illegal user %.100s from %.100s",
525 logit("Illegal user %.100s from %.100s",
499 user, get_remote_ipaddr());
526 user, get_remote_ipaddr());
500#ifdef WITH_AIXAUTHENTICATE
501 loginfailed(user,
502 get_canonical_hostname(options.verify_reverse_mapping),
503 "ssh");
527#ifdef CUSTOM_FAILED_LOGIN
528 record_failed_login(user, "ssh");
504#endif
505 return (NULL);
506 }
507 if (!allowed_user(pw))
508 return (NULL);
509#ifdef HAVE_LOGIN_CAP
510 if ((lc = login_getpwclass(pw)) == NULL) {
511 debug("unable to get login class: %s", user);

--- 48 unchanged lines hidden (view full) ---

560{
561 if (auth_debug_init)
562 buffer_clear(&auth_debug);
563 else {
564 buffer_init(&auth_debug);
565 auth_debug_init = 1;
566 }
567}
529#endif
530 return (NULL);
531 }
532 if (!allowed_user(pw))
533 return (NULL);
534#ifdef HAVE_LOGIN_CAP
535 if ((lc = login_getpwclass(pw)) == NULL) {
536 debug("unable to get login class: %s", user);

--- 48 unchanged lines hidden (view full) ---

585{
586 if (auth_debug_init)
587 buffer_clear(&auth_debug);
588 else {
589 buffer_init(&auth_debug);
590 auth_debug_init = 1;
591 }
592}
593
594struct passwd *
595fakepw(void)
596{
597 static struct passwd fake;
598
599 memset(&fake, 0, sizeof(fake));
600 fake.pw_name = "NOUSER";
601 fake.pw_passwd =
602 "$2a$06$r3.juUaHZDlIbQaO2dS9FuYxL1W9M81R1Tc92PoSNmzvpEqLkLGrK";
603 fake.pw_gecos = "NOUSER";
604 fake.pw_uid = -1;
605 fake.pw_gid = -1;
606#ifdef HAVE_PW_CLASS_IN_PASSWD
607 fake.pw_class = "";
608#endif
609 fake.pw_dir = "/nonexist";
610 fake.pw_shell = "/nonexist";
611
612 return (&fake);
613}